File name:

PluralinputSetup.exe

Full analysis: https://app.any.run/tasks/c9a98adb-5982-4d2f-9843-e871c9e7940c
Verdict: Malicious activity
Analysis date: August 01, 2025, 12:44:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

E8957EA522DC4A16FECA30A50011C5F7

SHA1:

5860991815D8F0316CAB477E60F6FBAC86DF8BEF

SHA256:

13FEF795803907D61816FC60A8DA26A20E6ACDB618A6250BBCA145D4528B37AF

SSDEEP:

98304:lrVZs62yrJqVJKvbq3eDcsmNV9k8R+3v4avuBymzkeVOxskhqCnbu0Mv8YS/Cuf7:ZbbksSi+y5bFTPWI3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • PluralinputSetup.exe (PID: 6376)
      • Update.exe (PID: 4196)
      • drvinst.exe (PID: 1712)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 3400)

    • Process drops legitimate windows executable

      • PluralinputSetup.exe (PID: 6376)
      • Update.exe (PID: 4196)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Drops a system driver (possible attempt to evade defenses)

      • Update.exe (PID: 4196)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Reads security settings of Internet Explorer

      • Update.exe (PID: 4196)
      • RemoteClient.exe (PID: 5968)
      • pidrvmgr64.exe (PID: 5188)
      • Pluralinput.UI.exe (PID: 5240)

    • Searches for installed software

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)

    • Creates a software uninstall entry

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)

    • Creates files in the driver directory

      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Adds/modifies Windows certificates

      • rundll32.exe (PID: 7092)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 3400)

  • INFO

    • Creates files or folders in the user directory

      • PluralinputSetup.exe (PID: 6376)
      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 6764)
      • RemoteClient.exe (PID: 5808)
      • Pluralinput.UI.exe (PID: 5240)
      • DeviceSetup.exe (PID: 6504)

    • The sample compiled with english language support

      • PluralinputSetup.exe (PID: 6376)
      • Update.exe (PID: 4196)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Checks supported languages

      • PluralinputSetup.exe (PID: 6376)
      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 6764)
      • RemoteClient.exe (PID: 5808)
      • RemoteClient.exe (PID: 5968)
      • Pluralinput.UI.exe (PID: 5240)
      • DeviceSetup.exe (PID: 6504)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Reads the computer name

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 6764)
      • RemoteClient.exe (PID: 5808)
      • Pluralinput.UI.exe (PID: 5240)
      • RemoteClient.exe (PID: 5968)
      • DeviceSetup.exe (PID: 6504)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Reads the machine GUID from the registry

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 6764)
      • RemoteClient.exe (PID: 5808)
      • Pluralinput.UI.exe (PID: 5240)
      • RemoteClient.exe (PID: 5968)
      • DeviceSetup.exe (PID: 6504)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)

    • Create files in a temporary directory

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)
      • pidrvmgr64.exe (PID: 5188)
      • DeviceSetup.exe (PID: 6504)

    • Disables trace logs

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)

    • Process checks computer location settings

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)

    • Reads the software policy settings

      • Update.exe (PID: 4196)
      • pidrvmgr64.exe (PID: 5188)
      • RemoteClient.exe (PID: 5968)
      • Pluralinput.UI.exe (PID: 5240)
      • rundll32.exe (PID: 7092)
      • drvinst.exe (PID: 1712)

    • Checks proxy server information

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)
      • RemoteClient.exe (PID: 5968)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 1712)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 7092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:02:25 17:30:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 111104
InitializedDataSize: 6431232
UninitializedDataSize: -
EntryPoint: 0x9f36
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.15.17108.1
ProductVersionNumber: 0.15.17108.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Use multiple mice and keyboards on the same PC at the same time.
FileVersion: 0.15.17108.01
InternalName: Setup.exe
LegalCopyright: Copyright 2017 Christian Gulden
OriginalFileName: Setup.exe
ProductName: Use multiple mice and keyboards on the same PC at the same time.
ProductVersion: 0.15.17108.01
SquirrelAwareVersion: 1
CompanyName: Pluralinput
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
13
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pluralinputsetup.exe update.exe pluralinput.ui.exe no specs remoteclient.exe no specs pluralinput.ui.exe remoteclient.exe devicesetup.exe conhost.exe no specs pidrvmgr64.exe conhost.exe no specs drvinst.exe rundll32.exe no specs drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
1712DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{2571cee2-b07c-2344-bc34-1100412763e9}\pimou.inf" "9" "49175deeb" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\driver\x64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—DeviceSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3400DrvInst.exe "2" "211" "HID\VID_0627&PID_0001\6&6973F69&0&0000" "C:\WINDOWS\INF\oem1.inf" "oem1.inf:b2fe4818f103cc24:pimoukbd:1.0.0.0:hid_device_system_mouse," "49175deeb" "00000000000001CC"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
4196"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
PluralinputSetup.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5188".\Driver\pidrvmgr64.exe" installdevice "C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Driver\x64\pimou.inf" "HID\VID_0627&PID_0001\6&6973F69&0&0000"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Driver\pidrvmgr64.exe
DeviceSetup.exe
User:
admin
Company:
Christian Gulden
Integrity Level:
HIGH
Description:
Pluralinput Driver Manager
Exit code:
0
Version:
0.15.17104.03
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\driver\pidrvmgr64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5240"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Pluralinput.UI.exe" --squirrel-firstrunC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Pluralinput.UI.exe
Update.exe
User:
admin
Company:
Pluralinput
Integrity Level:
MEDIUM
Description:
Pluralinput
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\pluralinput.ui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5808"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\RemoteClient.exe" --squirrel-install 0.15.17108.01C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\RemoteClient.exe—Update.exe
User:
admin
Company:
Pluralinput
Integrity Level:
MEDIUM
Description:
Pluralinput RemoteClient
Exit code:
0
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\remoteclient.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5968"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\RemoteClient.exe" --squirrel-firstrunC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\RemoteClient.exe
Update.exe
User:
admin
Company:
Pluralinput
Integrity Level:
MEDIUM
Description:
Pluralinput RemoteClient
Exit code:
0
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\remoteclient.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6376"C:\Users\admin\AppData\Local\Temp\PluralinputSetup.exe" C:\Users\admin\AppData\Local\Temp\PluralinputSetup.exe
explorer.exe
User:
admin
Company:
Pluralinput
Integrity Level:
MEDIUM
Description:
Use multiple mice and keyboards on the same PC at the same time.
Exit code:
0
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\temp\pluralinputsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6504"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeviceSetup.exe" -tasksFile="C:\Users\admin\AppData\Local\Temp\tmp13FB.tmp" -resultFile="C:\Users\admin\AppData\Local\Temp\tmp13FC.tmp" -cancellationPipeName=98ee39e9-6483-45b6-8f39-89057c73e957C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeviceSetup.exe
Pluralinput.UI.exe
User:
admin
Company:
Pluralinput
Integrity Level:
HIGH
Description:
Pluralinput DeviceSetup
Exit code:
0
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\devicesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
31 453
Read events
31 332
Write events
108
Delete events
13

Modification events

(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
54
Suspicious files
9
Text files
28
Unknown types
16

Dropped files

PID
Process
Filename
Type
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\packages\Pluralinput-0.15.17108.01-full.nupkgcompressed
MD5:30D93F75C10C6D51BDA951141DABE909
SHA256:6BAAD91CB8D953FD565BCB2B849B7472BE67999D3EECB31F763A5AED668EC66E
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Caliburn.Micro.Platform.dllexecutable
MD5:A980E5236C1D7AF018D3CAA1268A573F
SHA256:65982AC608FD4DD04679131794B253DB38ADDF512A79F41179157BD5B011ECFE
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeltaCompressionDotNet.dllexecutable
MD5:FFA8AB2E87481D9DA99D224E0389C8D5
SHA256:13950B911243E13269EF2487A00147C824E2223A7FB9103EB21F765C795BE45E
6376PluralinputSetup.exeC:\Users\admin\AppData\Local\SquirrelTemp\Update.exeexecutable
MD5:F805F06D30DF96A7A65487E6908432AB
SHA256:99DFFDF0983C591B7C8CC8C19E3F63DBDA39F34F71BE2F0C43DF7BE137447CEF
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Caliburn.Micro.Platform.Core.dllexecutable
MD5:7A71F6750885D911667054C35ECB7B26
SHA256:99F9B753B3346925EDB5A5CB1DF0BA1627FAFED6F148C2612B590DA52EE765FB
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Caliburn.Micro.dllexecutable
MD5:5858572545166C9CF3C876697C798B4D
SHA256:F8E2D96BF3611FD69C212A0251A6247F7DBC193DA0CE640299D5F8CDF5DBA24A
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\Update.exeexecutable
MD5:F805F06D30DF96A7A65487E6908432AB
SHA256:99DFFDF0983C591B7C8CC8C19E3F63DBDA39F34F71BE2F0C43DF7BE137447CEF
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeltaCompressionDotNet.PatchApi.dllexecutable
MD5:A1E92E6CDA95789E88B732EAFA276B2B
SHA256:684DC7547BD5490184BC76E7F4B80CF40869F817A12E964DFC502C3F3DB07515
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeltaCompressionDotNet.MsDelta.dllexecutable
MD5:C848A2F5FA5FEAA71409795E8E8C69D0
SHA256:1CE872ED466A8A3466C808A7BABF3B597EC12E1CB84870E7A0CF00B2F5EF6DF4
6376PluralinputSetup.exeC:\Users\admin\AppData\Local\SquirrelTemp\RELEASEStext
MD5:061C6FCDDAC20DF43CE492C417698FF5
SHA256:C87512600EA7C20804266DBEFD245DBB6443697887F625BF403FBC4242B520E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
33
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5240
Pluralinput.UI.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
5968
RemoteClient.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
5240
Pluralinput.UI.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
5968
RemoteClient.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
5240
Pluralinput.UI.exe
GET
200
151.101.194.133:80
http://ocsp.globalsign.com/ExtendedSSLSHA256CACross/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAASUHHfmv
unknown
—
—
whitelisted
5240
Pluralinput.UI.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/rootr3/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDkcsy6lJu5Qk6Y9Bb61B
unknown
—
—
whitelisted
5240
Pluralinput.UI.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY%2F%2Ft2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc%2BoCMMmsCEhEhNxNTAB%2BcLwHYinGMCaJuMA%3D%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3944
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4460
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4196
Update.exe
81.169.145.94:443
pluralinput.com
Strato AG
DE
unknown
5240
Pluralinput.UI.exe
23.216.77.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5968
RemoteClient.exe
23.216.77.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5240
Pluralinput.UI.exe
151.101.194.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
5240
Pluralinput.UI.exe
151.101.2.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
pluralinput.com
  • 81.169.145.94
unknown
crl.microsoft.com
  • 23.216.77.43
  • 23.216.77.15
  • 23.216.77.5
  • 23.216.77.37
  • 23.216.77.41
  • 23.216.77.16
  • 23.216.77.13
  • 23.216.77.38
  • 23.216.77.17
whitelisted
ocsp.globalsign.com
  • 151.101.194.133
  • 151.101.130.133
  • 151.101.2.133
  • 151.101.66.133
whitelisted
ocsp2.globalsign.com
  • 151.101.2.133
  • 151.101.194.133
  • 151.101.66.133
  • 151.101.130.133
whitelisted
dc.services.visualstudio.com
  • 52.188.247.146
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.129
  • 40.126.31.71
  • 40.126.31.128
  • 40.126.31.69
  • 20.190.159.129
  • 20.190.159.64
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted

Threats

No threats detected
Process
Message
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Binding Pluralinput.UI.Views.NotifyIconView and Pluralinput.UI.ViewModels.NotifyIconViewModel.
Pluralinput.UI.exe
[Caliburn.Micro.Action] INFO: Setting DC of Pluralinput.UI.Views.NotifyIconView to Pluralinput.UI.ViewModels.NotifyIconViewModel.
Pluralinput.UI.exe
[Caliburn.Micro.Action] INFO: Attaching message handler Pluralinput.UI.ViewModels.NotifyIconViewModel to Pluralinput.UI.Views.NotifyIconView.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Attaching Pluralinput.UI.Views.NotifyIconView to Pluralinput.UI.ViewModels.NotifyIconViewModel.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for Handle.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for ShowDashboard.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for ExitApplication.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for get_Parent.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for set_Parent.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for get_DisplayName.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PluralinputSetup.exe